Legal

Discloses four optional profile questions: gender, an age range, a 5-digit ZIP stored as entered, and a political leaning. Answers stay on the account. They are not recorded on a poll answer, not shown next to a vote, and not used to choose which polls or sources an account sees. The profile page does not edit the display name. Account deletion removes the optional answers.

Discloses founder AI drafting: a founder may draft proposed polls with Anthropic's Claude or OpenAI's models, and a founder still reviews and approves every poll. Qualifies the poll definitions for race polls, which ask who a person expects to win a 2026 federal race and offer the candidates on the state's certified list. Section 5 says Ledger's founders answer polls like anyone else, and each answer counts once. Corrects section 5 (the number of responses is withheld below 10 and rounded below 100, not always shown; a closed poll keeps its last published result) and section 6 (a race poll is checked against the certified list, not by a model). Names the iOS app's separate Terms; section 8 says race polls are not posted and an Instagram caption carries the summary.

v2 product boundary. Rewritten for the public poll board: accounts (email + password, email code, Google), answering and emoji reactions, open aggregate results behind a 10-response floor, the founder review process and its AI checks, social posts of published polls, and account deletion by email request. Drops the ballot, quiz, AI assistant, civic activity, Daily Five, shareable cards, feedback, mobile apps, and the post-Alpha donation, subscription, and advertising sections.

Catch-up rewrite for shipped product surfaces. Adds polls, civic-activity engine (streaks/points/leaderboard), mobile apps and push notifications, explain feature, chat ratings, feedback, tiered chat-abuse enforcement with appeal path, and expanded account-deletion scope. Post-Alpha sections retained.

Initial published Terms of Service. Covers eligibility, account, acceptable use, AI output disclaimer, user content license, shareable artifacts, donation link-out (post-Alpha), subscription and advertising (post-Alpha), termination, disclaimers, limitation of liability, Delaware governing law, binding individual arbitration with small-claims carve-out, and change-notification policy.

Discloses optional profile answers stored on the account: gender, an age range, a 5-digit ZIP as entered (or a decline, with no digits), and political leaning. Ledger does not resolve a state or district from the ZIP, does not copy the answers onto a poll answer, does not show them next to a vote, and does not use them to choose polls or sources. A street address, district, coordinates, device location, and date of birth stay uncollected. The display name is set at sign-up and is not edited on the profile page. Account deletion removes the answers.

Discloses founder AI drafting as a fourth AI use, adds OpenAI as a sub-processor, and widens the Anthropic row to drafting; neither receives user data. Adds the optional authenticator app to the collection table: its secret key, name, status, and set-up and last-used times, and each code check's time and IP address, held by Supabase Auth. Describes a race poll's results as each candidate's share, and says Ledger's founders answer polls like anyone else, and each answer counts once. Names the record of certain staff actions in the review tools (admin_actions), which keeps a staff account's identifier after that account is deleted. Corrects sections 6 and 7 to match the board: a race poll is checked against the certified list, not by a model; the number of responses is withheld below 10 and rounded below 100; a closed poll keeps its last published result; a deleted answer leaves a poll's results at its next publish. Names the iOS app's separate policies, states the reaction floor separately, discloses removed-reaction markers, and says race polls are not posted to social media.

v2 product boundary. Collection narrows to email, sign-in method, a display name set from the sign-in identity, poll answers, emoji reactions, and Terms/Privacy acceptances; no location or other profile data. Adds open floor-protected results and social posts; sub-processors are Supabase, Vercel, Anthropic, Upstash, Slack, Sentry, X, and Meta; account deletion and data requests move to email.

Corrective disclosure of existing practice — no change to collection, use, retention, or sharing. Geocoded coordinates are disclosed as stored on the profile (v3.0.0 said 'not stored'). Collection and retention tables gain citizenship attestation, voter-registration status, poll skips, Daily Five attempts/claims, and Premium subscription state with Stripe identifiers. The first-party `events`-table analytics description is replaced with the actual posture (Vercel server logs and runtime metrics only; no analytics product, no client-side analytics). Sentry is disclosed as a sub-processor for server-side web error reporting and mobile crash reporting. Share-link revocation corrected (the public URL dies immediately; the frozen snapshot row is retained for the user's own share history and cascades on account deletion) and the password-reset email removed (no such flow exists). Deletion, export, and Stripe post-deletion wording corrected to the shipped paths.

Catch-up rewrite for shipped product surfaces. Adds poll responses, civic-activity engine, mobile push device tokens, chat message ratings, feedback submissions, explain feature disclosure, Expo sub-processor, and expanded retention/deletion/CCPA export scope. Post-Alpha sections retained.

Chat history policy update. Privacy Policy now discloses user-visible saved chat history, profile-level delete controls, and a 365-day retention window from last activity enforced by scheduled purge instead of lifetime retention.

Initial published Privacy Policy. Mirrors docs/engineering/privacy.md: address, quiz, chat log, OTP, email; CCPA applied nationally; Supabase/Vercel/Anthropic/Mapbox/FEC/Upstash sub-processors; Stripe and companion memory flagged as post-Alpha; no behavioral email, no third-party trackers.

Discloses founder-directed drafting: a founder may draft proposed polls with a general-purpose AI assistant (Anthropic's Claude or OpenAI's models) that receives no user data; the automated news drafter stays off. Qualifies the poll definition for race polls and notes that a race poll is checked against the certified list, not by a model. Corrects section 2 to the source gate and the five model-judged rules. Non-consent-bearing.

v2 product boundary. Vera, chat, and explain are removed; the policy now covers Ledger's AI use — grading proposed polls, the advisory stock-photo screen, and choosing which vetted library photograph accompanies a poll, all inside a founder-approved review process, with no personal data sent to a model — and discloses the news-drafting feature, which is off in production. Non-consent-bearing.

AI Policy coverage update. Ledger now displays official state ballot-measure records — official ballot title, state-designated official summary, and a link to the full official text — on its per-state measures pages; the 'Coverage is federal' quick-summary bullet and the '§1 Ballot measures — does not yet ingest measure text' bullet are corrected and 'Why federal-only' is reframed to 'Why coverage is mostly federal.' Vera itself does not summarize, interpret, or recommend on a measure; state and local races and candidates remain out of scope. Non-consent-bearing.

AI Policy abuse-handling update. Documents shipped code-level refusal handling, low-cardinality suspicious-attempt metadata, metadata-only internal review, tiered chat suspension, and the appeal path. Non-consent-bearing.

Initial published AI Policy. Identity and coverage of Vera (Ledger's AI assistant), neutrality standard, source hierarchy and citation rules, what Vera will not do, refusal posture and interim abuse-handling posture, versioning and review. Mirrors the policy decisions inventory established in the C01+C04 prompt rewrite. Non-consent-bearing.